Replace a SCIM token; the old one keeps working for the overlap.

Organization admins only (403 organization_admin_required), on a browser session with a fresh proof in the x-50h-reauth header (401 reauth_required). It needs a person: API keys, connected apps and service accounts get 403 session_required. Every change is written to the organization's audit. overlapHours 0 ends the old token at once; up to 168. 409 already_rotated. Behind the scim sub-flag: 404 not_found while it is off. The SCIM protocol itself is at /scim/v2 for the identity provider (Okta, Microsoft Entra ID), with the token as its bearer; see the SCIM setup guide.